Recurrent neural networks for malware analysis
Using a recurrent neural network (RNN) that has been trained to a satisfactory level of performance, highly discriminative features can be extracted by running a sample through the RNN, and then extracting a final hidden state h i , where i is the number of instructions of the sample. This resulting feature vector may then be concatenated with the other hand-engineered features, and a larger classifier may then be trained on hand-engineered as well as automatically determined features. Related apparatus, systems, techniques and articles are also described.
1. A method comprising:
receiving or accessing data encapsulating a sample of at least a portion of one or more files;
feeding at least a portion of the received or accessed data as a time-based sequence into a recurrent neural network (RNN) trained using historical data;
extracting, by the RNN, a final hidden state h i in a hidden layer of the RNN in which i is a number of elements of the sample; and
determining, using the RNN and the final hidden state, whether at least a portion of the sample is likely to comprise malicious code.
2. The method of claim 1 , wherein the received or accessed data forms at least part of a data stream.
3. The method of claim 1 , wherein the at least a portion of the received or accessed data comprises a series of fixed-length encoded words.
4. The method of claim 1 , wherein the elements comprises a series of instructions.
5. The method of claim 1 , wherein the hidden state is defined by: h t =f (x, h t-1 ), wherein hidden state h t is a time-dependent function of input x as well as a previous hidden state h t-1 .
6. The method of claim 1 , wherein the RNN is an Elman network.
7. The method of claim 6 , wherein the Elman network has deep transition or decoding functions.
8. The method of claim 6 , wherein the Elman network parameterizes f (x, h t-1 ) as h t =g (W 1X +Rh t-1 );
where hidden state h t is a time-dependent function of input x as well as previous hidden state h t-1 , W 1 is a matrix defining input-to-hidden connections, R is a matrix defining the recurrent connections, and g (•) is a differentiable nonlinearity.
9. The method of claim 8 further comprising: adding an output layer on top of the hidden layer, such that o t =a (W 2 h t ) where o t is output, W 2 defines a linear transformation of hidden activations, and σ (•) is a logistic function.
10. The method of claim 9 further comprising:
applying backpropagation through time by which parameters of network W 2 , W 1 , and R are iteratively refined to drive the output o t to a desired value as portions of the received or accessed data are passed through the RNN.
11. The method of claim 1 , wherein the RNN is a long short term memory network.
12. The method of claim 1 , wherein the RNN is a clockwork RNN.
13. The method of claim 1 , wherein the RNN is a deep transition function.
14. The method of claim 1 , wherein the RNN is an echo-state network.
15. The method of claim 1 further comprising:
providing data characterizing the determination.
16. The method of claim 15 , wherein providing data comprises at least one of: transmitting the data to a remote computing system, loading the data into memory, or storing the data.
17. The method of claim 1 , wherein the files are binary files.
18. The method of claim 1 , wherein the files are executable files.
19. A system comprising:
at least one programmable data processor; and
memory storing instructions which, when executed by the at least one programmable data processor, result in operations comprising:
receiving or accessing data encapsulating a sample of at least a portion of one or more files;
feeding at least a portion of the received or accessed data as a time-based sequence into a recurrent neural network (RNN) trained using historical data;
extracting, by the RNN, a final hidden state h i in a hidden layer of the RNN in which i is a number of elements of the sample; and
determining, using the RNN and the final hidden state, whether at least a portion of the sample is likely to comprise malicious code.
20. A non-transitory computer program product storing instructions which, when executed by at least one programmable data processor forming part of at least one computing device, result in operations comprising:
receiving or accessing data encapsulating a sample of at least a portion of one or more files;
feeding at least a portion of the received or accessed data as a time-based sequence into a recurrent neural network (RNN) trained using historical data;
extracting, by the RNN, a final hidden state h i in a hidden layer of the RNN in which i is a number of elements of the sample; and
determining, using the RNN and the final hidden state, whether at least a portion of the sample is likely to comprise malicious code.